From: Tushar Sugandhi <tusharsu@linux.microsoft.com> To: zohar@linux.ibm.com, stephen.smalley.work@gmail.com, casey@schaufler-ca.com, agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com, paul@paul-moore.com Cc: tyhicks@linux.microsoft.com, sashal@kernel.org, jmorris@namei.org, nramas@linux.microsoft.com, linux-integrity@vger.kernel.org, selinux@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dm-devel@redhat.com Subject: [PATCH v10 6/8] IMA: extend critical data hook to limit the measurement based on a label Date: Thu, 7 Jan 2021 20:07:06 -0800 [thread overview] Message-ID: <20210108040708.8389-7-tusharsu@linux.microsoft.com> (raw) In-Reply-To: <20210108040708.8389-1-tusharsu@linux.microsoft.com> The IMA hook ima_measure_critical_data() does not support a way to specify the source of the critical data provider. Thus, the data measurement cannot be constrained based on the data source label in the IMA policy. Extend the IMA hook ima_measure_critical_data() to support passing the data source label as an input parameter, so that the policy rule can be used to limit the measurements based on the label. Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> --- include/linux/ima.h | 7 +++++-- security/integrity/ima/ima_main.c | 8 +++++--- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/include/linux/ima.h b/include/linux/ima.h index 37a0727c1c31..6d00542de135 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -30,7 +30,8 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size, extern void ima_post_path_mknod(struct dentry *dentry); extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); -extern void ima_measure_critical_data(const char *event_name, +extern void ima_measure_critical_data(const char *event_label, + const char *event_name, const void *buf, size_t buf_len, bool hash); @@ -126,9 +127,11 @@ static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} -static inline void ima_measure_critical_data(const char *event_name, +static inline void ima_measure_critical_data(const char *event_label, + const char *event_name, const void *buf, size_t buf_len, bool hash) {} + #endif /* CONFIG_IMA */ #ifndef CONFIG_IMA_KEXEC diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index ef37307e79dd..edfb1367a11d 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -915,6 +915,7 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) /** * ima_measure_critical_data - measure kernel integrity critical data + * @event_label: unique event label for grouping and limiting critical data * @event_name: event name for the record in the IMA measurement list * @buf: pointer to buffer data * @buf_len: length of buffer data (in bytes) @@ -925,15 +926,16 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) * structures, policies, and states stored in kernel memory that can * impact the integrity of the system. */ -void ima_measure_critical_data(const char *event_name, +void ima_measure_critical_data(const char *event_label, + const char *event_name, const void *buf, size_t buf_len, bool hash) { - if (!event_name || !buf || !buf_len) + if (!event_name || !event_label || !buf || !buf_len) return; process_buffer_measurement(NULL, buf, buf_len, event_name, - CRITICAL_DATA, 0, NULL, + CRITICAL_DATA, 0, event_label, hash); } -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Tushar Sugandhi <tusharsu@linux.microsoft.com> To: zohar@linux.ibm.com, stephen.smalley.work@gmail.com, casey@schaufler-ca.com, agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com, paul@paul-moore.com Cc: sashal@kernel.org, dm-devel@redhat.com, selinux@vger.kernel.org, jmorris@namei.org, linux-kernel@vger.kernel.org, nramas@linux.microsoft.com, linux-security-module@vger.kernel.org, tyhicks@linux.microsoft.com, linux-integrity@vger.kernel.org Subject: [dm-devel] [PATCH v10 6/8] IMA: extend critical data hook to limit the measurement based on a label Date: Thu, 7 Jan 2021 20:07:06 -0800 [thread overview] Message-ID: <20210108040708.8389-7-tusharsu@linux.microsoft.com> (raw) In-Reply-To: <20210108040708.8389-1-tusharsu@linux.microsoft.com> The IMA hook ima_measure_critical_data() does not support a way to specify the source of the critical data provider. Thus, the data measurement cannot be constrained based on the data source label in the IMA policy. Extend the IMA hook ima_measure_critical_data() to support passing the data source label as an input parameter, so that the policy rule can be used to limit the measurements based on the label. Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> --- include/linux/ima.h | 7 +++++-- security/integrity/ima/ima_main.c | 8 +++++--- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/include/linux/ima.h b/include/linux/ima.h index 37a0727c1c31..6d00542de135 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -30,7 +30,8 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size, extern void ima_post_path_mknod(struct dentry *dentry); extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); -extern void ima_measure_critical_data(const char *event_name, +extern void ima_measure_critical_data(const char *event_label, + const char *event_name, const void *buf, size_t buf_len, bool hash); @@ -126,9 +127,11 @@ static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} -static inline void ima_measure_critical_data(const char *event_name, +static inline void ima_measure_critical_data(const char *event_label, + const char *event_name, const void *buf, size_t buf_len, bool hash) {} + #endif /* CONFIG_IMA */ #ifndef CONFIG_IMA_KEXEC diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index ef37307e79dd..edfb1367a11d 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -915,6 +915,7 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) /** * ima_measure_critical_data - measure kernel integrity critical data + * @event_label: unique event label for grouping and limiting critical data * @event_name: event name for the record in the IMA measurement list * @buf: pointer to buffer data * @buf_len: length of buffer data (in bytes) @@ -925,15 +926,16 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) * structures, policies, and states stored in kernel memory that can * impact the integrity of the system. */ -void ima_measure_critical_data(const char *event_name, +void ima_measure_critical_data(const char *event_label, + const char *event_name, const void *buf, size_t buf_len, bool hash) { - if (!event_name || !buf || !buf_len) + if (!event_name || !event_label || !buf || !buf_len) return; process_buffer_measurement(NULL, buf, buf_len, event_name, - CRITICAL_DATA, 0, NULL, + CRITICAL_DATA, 0, event_label, hash); } -- 2.17.1 -- dm-devel mailing list dm-devel@redhat.com https://www.redhat.com/mailman/listinfo/dm-devel
next prev parent reply other threads:[~2021-01-08 4:09 UTC|newest] Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-01-08 4:07 [PATCH v10 0/8] IMA: support for measuring kernel integrity critical data Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 1/8] IMA: generalize keyring specific measurement constructs Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 2/8] IMA: add support to measure buffer data hash Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 3/8] IMA: define a hook to measure kernel integrity critical data Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 4/8] IMA: add policy rule to measure " Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 5/8] IMA: limit critical data measurement based on a label Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-14 2:09 ` Mimi Zohar 2021-01-14 2:09 ` [dm-devel] " Mimi Zohar 2021-01-14 17:57 ` Tushar Sugandhi 2021-01-14 17:57 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` Tushar Sugandhi [this message] 2021-01-08 4:07 ` [dm-devel] [PATCH v10 6/8] IMA: extend critical data hook to limit the " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 7/8] IMA: define a builtin critical data measurement policy Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-08 4:07 ` [PATCH v10 8/8] selinux: include a consumer of the new IMA critical data hook Tushar Sugandhi 2021-01-08 4:07 ` [dm-devel] " Tushar Sugandhi 2021-01-12 16:27 ` Paul Moore 2021-01-12 16:27 ` [dm-devel] " Paul Moore 2021-01-12 18:25 ` Lakshmi Ramasubramanian 2021-01-12 18:25 ` [dm-devel] " Lakshmi Ramasubramanian 2021-01-13 19:13 ` Mimi Zohar 2021-01-13 19:13 ` [dm-devel] " Mimi Zohar 2021-01-13 19:19 ` Paul Moore 2021-01-13 19:19 ` [dm-devel] " Paul Moore 2021-01-13 21:11 ` Mimi Zohar 2021-01-13 21:11 ` [dm-devel] " Mimi Zohar 2021-01-13 22:10 ` Paul Moore 2021-01-13 22:10 ` [dm-devel] " Paul Moore 2021-01-13 23:10 ` Mimi Zohar 2021-01-13 23:10 ` [dm-devel] " Mimi Zohar 2021-01-14 2:40 ` Paul Moore 2021-01-14 2:40 ` [dm-devel] " Paul Moore 2021-01-14 2:49 ` Mimi Zohar 2021-01-14 2:49 ` [dm-devel] " Mimi Zohar 2021-01-14 16:22 ` Lakshmi Ramasubramanian 2021-01-14 16:22 ` [dm-devel] " Lakshmi Ramasubramanian 2021-01-14 16:44 ` Mimi Zohar 2021-01-14 16:44 ` [dm-devel] " Mimi Zohar 2021-01-14 16:50 ` Mimi Zohar 2021-01-14 16:50 ` [dm-devel] " Mimi Zohar 2021-01-14 17:48 ` Lakshmi Ramasubramanian 2021-01-14 17:48 ` [dm-devel] " Lakshmi Ramasubramanian 2021-01-14 19:21 ` Lakshmi Ramasubramanian 2021-01-14 19:21 ` [dm-devel] " Lakshmi Ramasubramanian 2021-01-14 16:51 ` Paul Moore 2021-01-14 16:51 ` [dm-devel] " Paul Moore 2021-01-15 12:54 ` [PATCH v10 0/8] IMA: support for measuring kernel integrity critical data Mimi Zohar 2021-01-15 12:54 ` [dm-devel] " Mimi Zohar 2021-01-15 17:26 ` Tushar Sugandhi 2021-01-15 17:26 ` [dm-devel] " Tushar Sugandhi
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210108040708.8389-7-tusharsu@linux.microsoft.com \ --to=tusharsu@linux.microsoft.com \ --cc=agk@redhat.com \ --cc=casey@schaufler-ca.com \ --cc=dm-devel@redhat.com \ --cc=gmazyland@gmail.com \ --cc=jmorris@namei.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=nramas@linux.microsoft.com \ --cc=paul@paul-moore.com \ --cc=sashal@kernel.org \ --cc=selinux@vger.kernel.org \ --cc=snitzer@redhat.com \ --cc=stephen.smalley.work@gmail.com \ --cc=tyhicks@linux.microsoft.com \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.